Google Android Mobile operating system

Android OS DoS: Missing Permission Check in AndroidManifest.xml
CVE-2026-28573 - June 18, 2026

In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android PhoneInterfaceManager Local Priv Escalation via Carrier Bypass
CVE-2026-0063 - June 17, 2026

In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Improper Privilege Management

Android MmsSmsProvider.java Local Info Disclosure via Missing Permission
CVE-2026-28587 - June 17, 2026

In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android Telecomm Auth Bypass Unauthorized Calls (CVE-2026-28615)
CVE-2026-28615 - June 17, 2026

In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android NFC UAF in Nfc::eventCallback (CVE-2026-0083)
CVE-2026-0083 - June 17, 2026

In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Race Condition

Google Android: NFC Dispatcher Auto-Assign Special Permission LPE
CVE-2026-0082 - June 17, 2026

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Insecure Default Variable Initialization

Android NFC Event Spoofing via Missing Permission Check
CVE-2026-0081 - June 17, 2026

In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android SettingsLib Local Escalation via Missing Permission Check
CVE-2026-0071 - June 17, 2026

In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android PackageInstallerSession Local DoS via Memory Exhaustion
CVE-2026-28575 - June 17, 2026

In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Resource Exhaustion

Android Local DoS via Resource Exhaustion
CVE-2026-0064 - June 17, 2026

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Resource Exhaustion

Android Package Manager Device Lock Bypass LPE (APK)
CVE-2026-0092 - June 17, 2026

In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Local Priv Esc via PackageInstallerService on Android (CVE-2026-0068)
CVE-2026-0068 - June 17, 2026

In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation.

Race Condition

Android Contacts Provider Info Disclosure via Missing Permission Check
CVE-2026-0057 3.3 - Low - June 17, 2026

In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android SettingsLib Escalation of Privilege via Component Disabling
CVE-2026-0019 7.8 - High - June 17, 2026

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Improper Privilege Management

Android Provisioning Bypass via Improper Input Local Priv Escalation
CVE-2025-48643 7.8 - High - June 17, 2026

In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Improper Input Validation

Android Passkey Escalation via Missing Permission Check
CVE-2025-48640 8 - High - June 17, 2026

In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android CarrierConfigLoader UID Bypass in overrideConfig
CVE-2025-48617 7.8 - High - June 17, 2026

In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Android Bluetooth btm_sec.cc logic flaw lets attacker intercept SMS
CVE-2025-48571 4.3 - Medium - June 17, 2026

In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Protection Mechanism Failure

Out-of-bounds RTCP decoder read in Chrome WebRTC
CVE-2026-0165 5.7 - Medium - June 16, 2026

In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Classic Buffer Overflow

Google Modem OOB Write Enables Remote Code Execution
CVE-2026-0164 8.8 - High - June 16, 2026

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

Memory corruption via type confusion in AudioSdpParser.cpp RCE
CVE-2026-0162 8.8 - High - June 16, 2026

In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Object Type Confusion

Google Cast RtpSession.cpp OOB Write Remote Priv Escalation
CVE-2026-0161 8.8 - High - June 16, 2026

In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Integer Overflow or Wraparound

RCE via OOB write in Google IoT TextRtpPayloadDecoderNode
CVE-2026-0160 8.8 - High - June 16, 2026

In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

Android Camera: Missing Permission Check Enabling Local Photo Disclosure
CVE-2026-0158 3.3 - Low - June 16, 2026

In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Google Devices RTCP OOB Read in RtcpHeader::decodeRtcpHeader
CVE-2026-0157 4.3 - Medium - June 16, 2026

In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Out-of-bounds Read

Google Cast RTP Null Check Bug Enables Remote DoS
CVE-2026-0156 - June 16, 2026

In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Android ImsMediaBitReader OOB Read Enables Remote Info Disclosure
CVE-2026-0155 4.3 - Medium - June 16, 2026

In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Out-of-bounds Read

Google Modem SIP REFER memory corruption allows RCE
CVE-2026-0154 8.8 - High - June 16, 2026

In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

Google Chrome OS msg_to_host_buffer.cc OOB Write Allows Local Priv Escalation
CVE-2026-0153 7.8 - High - June 16, 2026

In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Memory Corruption

Priv Escalation via VMA OOB in OSMMapPMRGeneric
CVE-2026-0152 7.8 - High - June 16, 2026

In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Buffer Overflow

Android intfgraph.c OOB Write allows RCE
CVE-2026-0151 8.8 - High - June 16, 2026

In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Integer Overflow or Wraparound

EdgeTPU Firmware OOB Write via Int Overflow Enables Local Priv Escalation
CVE-2026-0150 7.8 - High - June 16, 2026

In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with root privileges needed. User interaction is not needed for exploitation.

Integer Overflow or Wraparound

Remote Code Exec via Heap OOB Write in RtpSession::rtpSendRtcpPacket
CVE-2026-0149 8.8 - High - June 16, 2026

In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Heap-based Buffer Overflow

OOB Write via Integer Overflow in VideoRtpPayloadDecoderNode.cpp (CVE-2026-0148)
CVE-2026-0148 8.8 - High - June 16, 2026

In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Integer Overflow or Wraparound

Android MFC Core NAL Q OOB Write RCE in mfc_core_nal_q.c
CVE-2026-0147 8.8 - High - June 16, 2026

In __mfc_core_nal_q_get_dec_metadata_sei_nal of mfc_core_nal_q.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

Android MFC core OOB write RCE
CVE-2026-0146 8.8 - High - June 16, 2026

In mfc_core_get_dec_metadata_sei_nal of mfc_core_reg_api.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

Android Keymint Permission Bypass Exposing Local Info
CVE-2026-0145 3.3 - Low - June 16, 2026

In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Google AocAudioCodec.cpp Bounds Check Omission Enables Remote DoS
CVE-2026-0144 6.5 - Medium - June 16, 2026

In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

Android lwis_device_external_event_emit UAF PrivEsc
CVE-2026-0143 7.8 - High - June 16, 2026

In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Dangling pointer

Android AVB iavb_parse_key_data OOBR Info Disclosure
CVE-2026-0142 3.3 - Low - June 16, 2026

In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Out-of-bounds Read

OOB Read in RTCP App Packet Decode (Google Nest Audio)
CVE-2026-0141 4.3 - Medium - June 16, 2026

In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

OOB Read in RtpPacket::decodePacket via Int Overflow
CVE-2026-0140 4.3 - Medium - June 16, 2026

In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

Integer Overflow or Wraparound

Out-of-Bounds Write in Google Modem Leads to RCE
CVE-2026-0139 8.8 - High - June 16, 2026

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Buffer Overflow

Local Priv Esc via OOB Write in lwis I/O Buffer for Google Devices
CVE-2026-0138 7.8 - High - June 16, 2026

In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Classic Buffer Overflow

Edge TPU Runtime UAF Privilege Escalation
CVE-2026-0137 7.8 - High - June 16, 2026

In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Dangling pointer

Modem OOB Read Remote DoS (Google Modem)
CVE-2026-0136 6.5 - Medium - June 16, 2026

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Out-of-bounds Read

Modem OOB Read RCE in Google Android Modem
CVE-2026-0135 7.8 - High - June 16, 2026

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Out-of-bounds Read

Android Recovery UI Data Persistence Disclosure
CVE-2026-0134 3.3 - Low - June 16, 2026

In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Insecure Default Initialization of Resource

Android Runtime SMMU privilege escalation via missing perm check
CVE-2026-0133 7.8 - High - June 16, 2026

In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AuthZ

Google Modem Heap Buffer Overflow RCE
CVE-2026-0132 8.8 - High - June 16, 2026

In Modem, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Heap-based Buffer Overflow